The Dutch data protection authority (AP) has fined the foreign affairs ministry €565,000 for potentially breaching the privacy of people making visa applications over a number of years.

The AP says the national visa system is not secure enough, and there is a risk unauthorised people could view and change files. In addition, people applying for visas were not given proper information about the way their data is shared with third parties, the AP said.

The ministry has handled some 530,000 visa applications for visits to the Netherlands every year for the past three years.

The AP says sensitive information, such as fingerprints, name, address, purpose of the trip, nationality and photo could have been accessed because of ‘inadequate physical and digital security’ and this could also allow abuses to go on unnoticed for ‘too long’.

The agency did not say if any such abuses had taken place.

The ministry has been aware of security risks in the visa system for a long time, but has not tackled the problem seriously, AP deputy chairwoman Monique Verdier said in a statement.

‘Security has been failing for years and in our view the ministry has been grossly negligent and continues to be so,’ she said.

The ministry will be fined a further €50,000 for every two weeks that appropriate improvements have not been made.